# Connect a Provider A model provider needs a credential before kli can call it. The `/auth` command registers that credential and reports whether the provider is now available. There are three ways to supply one: point at an environment variable, store a static API key, or run an OAuth login. You run these from inside a kli session. To see what is already registered, run `/auth` with no arguments. It lists each provider and reference and whether the credential resolves. ## Reference an environment variable Use this when the key already lives in your shell environment and you do not want kli to keep a copy. ``` /auth env ``` For example: ``` /auth env anthropic ANTHROPIC_API_KEY ``` kli registers a reference to the named variable and reads it fresh on every request. The value is never copied into kli's credential file, so it lives only as long as the variable does in the process environment. If the variable is unset, the provider reports as unavailable until you set it. ## Store a static API key Use this when you have a key string and want kli to keep it. ``` /auth key ``` For example: ``` /auth key openai sk-... ``` The key is written to the credential file and reused on later runs. kli does not echo the key back in its reply; it confirms only the provider and whether the credential is available. ## Run an OAuth login Some providers authenticate with OAuth instead of a key. kli uses PKCE and never runs a local callback server: it gives you a URL, you authorize in a browser, then you paste the result back. Start the login: ``` /auth login ``` For example: ``` /auth login openai-codex ``` If a stored OAuth credential already exists for that provider, kli restores it and reports the provider as available. Otherwise it prints an authorization URL. Open the URL, complete the sign-in, and the provider's page hands you an authorization code (or a redirect URL containing one). Paste that back to finish: ``` /auth code ``` `/auth code` accepts the bare code, a `code#state` pair, a `code=...` query string, or the full redirect URL; kli pulls the code out of whichever form you paste. It exchanges the code for tokens, stores them, and reports the provider as available. The pasted input is never echoed. `/auth code` completes the single pending login. Run one `/auth login` at a time: if more than one is in flight, kli asks you to finish them individually before it will accept a code. ## Remove a credential ``` /auth logout ``` This deletes the provider's stored credential from the credential file. An environment-variable reference is not stored, so there is nothing to delete for one; unset the variable instead. ## Where credentials are stored Stored API keys and OAuth tokens persist to `~/.config/kli/credentials.json`, written with file mode `0600` (owner read/write only). Environment-variable references are not written there — they resolve from the live environment each time. `/auth` itself is hidden from the model, because its argument can carry a raw key. For the providers kli ships and which auth mode each uses, see [Models & Providers](/kli/models/providers-and-transports). Once a provider authenticates, its models become selectable. See [Switch Models](/kli/guides/choose-and-switch-models) to choose one, and [Settings Reference](/kli/config/settings) for configuration that is set up front rather than in a session.